Data field masking and logging system and method

Abstract

A computer-implemented method for controlling the expression of a block of data from a sensitive data storage device, the method including the steps of receiving from a software application a request to transfer the block of data from the source sensitive data storage device for expression at a destination device, determining a data mask indicator for the block of data, applying a limited expression format based upon the data mask indicator, and expressing the block of data at the destination device in the limited expression format, such as to facilitate protecting or masking sensitive data. The method may further include allowing a user to request revelation of a masked portion of the block of data, recording in a memory log user activity relating to such revelation request(s) of the user, and providing regular reports and/or administrative alerts relating to such logged user activity.

I claim: 
     
       1. A computer-implemented method for controlling expression of data from a sensitive data storage device, the computer-implemented method comprising:
 receiving from a software application, at or via one or more processors, a revelation request initiated by a user, the revelation request relating to masked one or more portions of information of a data field; 
 revealing, in response to the revelation request, the masked one or more portions of the information of the data field at a destination device; 
 automatically logging, via the one or more processors, identification information of the user, a time and date of processing of the revelation request, and at least one of (a) a data type for the masked one or more portions of the information of the data field, (b) a data type for the data field, and (c) information to permit identification of the information of the data field to generate log data; 
 automatically reinstituting, via the one or more processors, masking of the revealed one or more portions of the information of the data field after a predetermined period of time; and 
 denying a revelation request from the user upon determining, based upon the log data, that a number of revelation requests from the user exceeds a predetermined threshold. 
 
     
     
       2. The computer-implemented method of  claim 1 , wherein the sensitive data storage device is a mass storage device of a personal computing device and the destination device is a visual display of the personal computing device. 
     
     
       3. The computer-implemented method of  claim 1 , the method further comprising maintaining, via the one or more processors, a security protocol around a plurality of secured devices comprising a protected network environment, wherein the plurality of secured devices includes the sensitive data storage device. 
     
     
       4. The computer-implemented method of  claim 3 , wherein the sensitive data storage device is a mass storage device of a server, the method further comprising a step of transmitting the information of the data field to the destination device via a network node. 
     
     
       5. The computer-implemented method of  claim 4 , wherein the network node is outside the protected network environment. 
     
     
       6. The computer-implemented method of  claim 1 , the method comprising:
 determining, via the one or more processors, a data mask indicator corresponding to the information of the data field, wherein the determining of the data mask indicator includes at least one of (a) determining a property of the information of the data field, (b) examining metadata associated with the data field, and (c) processing an instruction relating to the data field. 
 
     
     
       7. The computer-implemented method of  claim 6 , wherein the determining of the data mask indicator is performed at the sensitive data storage device. 
     
     
       8. The computer-implemented method of  claim 1 , the method comprising applying, via the one or more processors, a limited expression format to the information of the data field based upon a data mask indicator, wherein the limited expression format is applied to the information of the data field at the destination device. 
     
     
       9. A computer-implemented method for controlling expression of data from a sensitive data storage device, the computer-implemented method comprising:
 receiving from a software application, at or via one or more processors, a revelation request initiated by a user, the revelation request relating to masked one or more portions of information of a data field; 
 revealing, in response to the revelation request, the masked one or more portions of the information of the data field at a destination device; 
 automatically storing in a memory log, via the one or more processors, identification information of the user, a time and date of processing of the revelation request, and at least one of (a) a data type for the masked one or more portions of the information of the data field, (b) a data type for the data field, and (c) information to permit identification of the information of the data field to generate log data; 
 generating, via the one or more processors, a notification based upon at least a result of a comparison of the log data with a predetermined usage rule; and 
 denying a revelation request from the user upon determining, based upon the log data, that a number of revelation requests from the user exceeds a predetermined threshold. 
 
     
     
       10. The computer-implemented method of  claim 9 , wherein the sensitive data storage device is a mass storage device of a personal computing device and the destination device is a visual display of the personal computing device. 
     
     
       11. The computer-implemented method of  claim 9 , the method further comprising maintaining, via the one or more processors, a security protocol around a plurality of secured devices comprising a protected network environment, wherein the plurality of secured devices includes the sensitive data storage device. 
     
     
       12. The computer-implemented method of  claim 11 , wherein the sensitive data storage device is a mass storage device of a server, the method further comprising a step of transmitting the information of the data field to the destination device via a network node. 
     
     
       13. The computer-implemented method of  claim 12 , wherein the network node is outside the protected network environment. 
     
     
       14. The computer-implemented method of  claim 9 , the method further comprising applying, via the one or more processors, a limited expression format to the information of the data field based upon a data mask indicator, wherein the limited expression format is applied to the information of the data field at the destination device. 
     
     
       15. A computer-implemented method for controlling expression of data from a sensitive data storage device, the computer-implemented method comprising:
 receiving from a software application, at or via one or more processors, a revelation request initiated by a user, the revelation request relating to masked one or more portions of information of a data field; 
 revealing, in response to the revelation request, the masked one or more portions of the information of the data field at a destination device; 
 automatically storing in a memory log, via the one or more processors, identification information of the user, a time and date of processing of the revelation request, and at least one of (a) a data type for the masked one or more portions of the information of the data field, (b) a data type for the data field, and (c) information to permit identification of the information of the data field to generate log data; 
 adjusting, via the one or more processors, user permissions associated with rights to issue or be granted one or more revelation requests based upon at least a result of a comparison of the log data with a predetermined usage rule; and 
 denying a revelation request from the user upon determining, based upon the log data, that a number of revelation requests from the user exceeds a predetermined threshold. 
 
     
     
       16. The computer-implemented method of  claim 15 , wherein the sensitive data storage device is a mass storage device of a personal computing device, and the destination device is a visual display of the personal computing device. 
     
     
       17. The computer-implemented method of  claim 15 , the method further comprising maintaining, via the one or more processors, a security protocol around a plurality of secured devices comprising a protected network environment, wherein the plurality of secured devices includes the sensitive data storage device. 
     
     
       18. The computer-implemented method of  claim 17 , wherein the sensitive data storage device is a mass storage device of a server, the method further comprising transmitting the information of the data field to the destination device via a network node. 
     
     
       19. The computer-implemented method of  claim 18 , wherein the network node is outside the protected network environment. 
     
     
       20. The computer-implemented method of  claim 15 , the method comprising applying, via the one or more processors, a limited expression format to the information of the data field based upon a data mask indicator, wherein the limited expression format is applied to the information of the data field at the destination device.